Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm hoping to figure out the best possible way to force password changes for our users. We are running Mac OS X Server 10.6.2 and most of the desktop are Mac OS X 10.5.8. I can easily go into the Open Directory and force users to change password at login.

The problem, is that most users do NOT connect to the shares and would never be asked to change their password. If, they go to Go, Connect to Server, type server address, then it would ask them here.

We tried binding the desktops to the open directory server in the hope that when the user logged back in they would be prompted but even that doesn't seem to work properly. Another idea was to create a separate page, that can be accessed for inside where they can change their passwords.

We have a number of services tied into the OD already so we really need a good way to manage these password changes.

Any solutions would be very appreciated.

share|improve this question
up vote 1 down vote accepted

Edit based on comment thread:

You could push a script to everyone with Apple Remote Desktop that attempts to mount a sharepoint. Or, as you said above, Apple does provide a password changing website, but again, that would require emailing everyone and telling them to go to the website, which many might ignore.

How to set up an OD user who doesn't have a network home folder:

  1. Create the user in Workgroup Manager.
  2. Click on "Home" in the segmented control bar at the top.
  3. Click the plus button, leave the first two fields blank, and type /Users/username, where you would replace username with the short name of the user. At this point, you'd want to make sure that the user you're setting up doesn't already have a local account with the same name.
  4. Click Okay, then make sure that the entry you created is selected. It should have a harddrive icon and be listed as /Users. Click "create home now", then click save.

That's it! If you don't specify that the user should get a local folder and leave it as no home folder, you'll actually be unable to log in at all. Now you have all of the management you'd get with having a bound Machine and a network account, without the extra storage overhead (and possible long login times).

Old answer: I don't want to seem condescending but you really need to learn more before you jump into this. The Lynda training series videos for snow leopard server are great, or grab a book from the bookstore. Snow Leopard Server is very picky. Everything needs to be set up properly and in a very specific order. The best advice I can give you is to start fresh - open up a book or start the video and start from the beginning. Set up DNS exactly how they say, then wipe and reinstall OS X server (remember to run software update!) and go from there with a fresh start. I myself had to do that several times on a test server before I got the process down right.

share|improve this answer
@jack-lawrence I just wanted to revisit this issue once again. I know its been awhile. In particular I have gone through the Snow Leopard Server manual and Open Directory Admin. I appreciate the advice to start fresh but given the impact that would have on our network it most definitely is NOT an option. I'd love to be able to do this if it would mean being able to force a password policy to all users on the network but seems like a rather daunting task. Anyway, if you or anyone else has any further ideas I'd love to hear! – Aaron Feb 8 '11 at 16:47
Hmmm okay thanks for narrowing down the problem. I didn't realize everyone had local accounts. How do you manage them? Apple Remote Desktop? If so, you could push a script to everyone to attempt to mount a sharepoint. As you said above, Apple does provide a password changing website, but again, that would require emailing everyone and telling them to go to the website, which many might ignore. – Jack Lawrence Feb 8 '11 at 21:48
Thanks, wasn't sure if you'd see this since its been awhile. We do use Apple Remote Desktop for managing the systems. That's an interesting idea, so pushing an attempt to mount a sharepoint would in a sense force them to hit the server which would then get them to change their password. I wish we could easily do the bind just because it's so much cleaner in the long run. But the fact that we have local user accounts makes it harder. We don't care about copying data to server. But one issue we ran into was if the local user didn't match the network account we had troubles binding. – Aaron Feb 9 '11 at 6:47
Yep, the problem you outline is one of the many issues that mass-migrating from local accounts to server accounts has. It's really a huge nightmare because of all the little things that need to match up and work perfectly, and it's hard to test everything before deployment. You could try slowly migrating into it. Whenever you give someone a new machine or re-image it, bind them to the server, give them an OD Mobile Home account (offline data access/sync), and move their user data. It's totally worth it. Let me know if the script solves the problem or if you have any other questions. - Jack – Jack Lawrence Feb 10 '11 at 2:32
Ok cool, I really appreciate all your help. So far we've been binding the machines when we get them. Is it required to setup the Mobile Home account? The reason I ask is because we don't have any intention of storing all the users data on the servers since this would take up a lot of space. – Aaron Feb 11 '11 at 4:14

Are you using OD for login? If the password is expired, they should be prompted at login.

share|improve this answer
We aren't using OD for login. Is there a simple way to turn that on? – Aaron Jul 13 '10 at 18:59
@Aaron - Add the OD Master to the seach paths for the client machines. The only thing is that this will create new home folders, as OS X would think it's a new account (and technically it is). You can certainly write a script that would add the search path and then on login, copy the contents of the old home folder to the new one though. – MDMarra Jul 13 '10 at 19:13
Okay, I do have the OD added in the Directory Utility. And under Search Policy I have /LDAPv3/ Above this /BSD/local and /Local/Default are greyed out. Is this correct? Does this mean the OD is in the search path? – Aaron Jul 13 '10 at 19:27
If you have local accounts on the local machine that are the same as the names in OD, they will use the local account first since /Local/Default is above /LDAPv3/ You can either remove the local account and login normally, this should use OD authentication. Or you can drag the OD server above /Default/Local in the search path. Either way. – MDMarra Jul 13 '10 at 19:47
I see what you mean. For some reason, it is not allowing for me to drag the OD server above the /Default/Local search path. – Aaron Jul 13 '10 at 19:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.